Senior Product Security Engineer

Overview

The Senior Product Security Engineer drives product security activities across the product lifecycle for medical devices, connected care platforms, software applications, embedded products, and cloud-connected healthcare systems. The role collaborates with R&D, Systems Engineering, Quality, Regulatory, Product, and development teams to integrate cybersecurity into product development processes.

What you'll do

• Perform security risk assessments throughout the product development lifecycle.
• Conduct threat modeling activities using methodologies such as STRIDE, Attack Trees, MITRE ATT&CK, CVSS, and similar frameworks.
• Identify product security requirements and support implementation of appropriate security controls.
• Review system, software, cloud, and network architectures from a security perspective.
• Collaborate with development teams to design secure products and mitigate identified risks.
• Plan and execute security testing activities including vulnerability assessments, penetration testing, secure code reviews, security regression testing, protocol security testing, and network security testing.
• Analyze, prioritize, and track vulnerabilities through remediation and verification activities.
• Support coordinated vulnerability disclosure and post-market cybersecurity processes.
• Integrate cybersecurity activities into product development processes.
• Support security design reviews, security architecture assessments, security impact assessments, security KPIs, security metrics, automation initiatives, and DevSecOps practices.

What you'll need

• Bachelor's degree or Master's degree in Computer Science, Cybersecurity, Information Technology, Software Engineering, or Electronics & Communication Engineering with 8+ years of experience in Product Security, Application Security, Cybersecurity Engineering, or Medical Device Security.
• Experience working with connected products, embedded systems, desktop applications, cloud services, Internet of Things (IoT) platforms, or healthcare technology products.
• Experience in security risk assessments, threat modeling, security architecture reviews, security requirements engineering, vulnerability assessments, penetration testing, secure code reviews, network security testing, and web/API security testing.
• Experience with security tools including Burp Suite, OWASP ZAP, Nessus, Nmap, Wireshark, Metasploit, or similar application and infrastructure security tools.
• Experience developing scripts and automation tools using Python.
• Experience supporting Secure Software Development Lifecycle (SSDLC), DevSecOps, vulnerability management, and security automation activities.

Nice to have

• Experience securing Class I, Class II, and Class III medical devices, connected healthcare solutions, Software as a Medical Device (SaMD), or cloud-connected healthcare systems.
• Knowledge of FDA Cybersecurity Guidance, IEC 81001-5-1, AAMI TIR57, AAMI TIR97, IEC 62304, ISO 14971, and NIST 800-53.
• Experience with Software Bill of Materials (SBOM), dependency analysis, coordinated vulnerability disclosure, and post-market cybersecurity activities.
• Knowledge of cloud security in Microsoft Azure and Amazon Web Services (AWS) environments.
• Knowledge of authentication and authorization technologies, cryptography fundamentals, and secure communication protocols including TLS, HTTPS, and MQTT.

Details

• Location: Nanakramguda, Hyderabad, India.
• Work arrangement: Flex.
• No travel is required.